The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/generate_pdf.py utilizes the subprocess module to execute pandoc and xelatex. The implementation correctly uses argument lists rather than shell strings, which is the recommended method for preventing command injection.
[EXTERNAL_DOWNLOADS]: The scripts/verify_citations.py script performs network requests to doi.org and api.crossref.org. These are well-known academic services used to retrieve citation metadata, and the operations are consistent with the skill's purpose.
[PROMPT_INJECTION]: The skill instructions include strong directives regarding the mandatory inclusion of visuals. These are workflow instructions designed for output quality and do not attempt to bypass agent safety protocols.
[PROMPT_INJECTION]: The skill processes external data like paper abstracts. While this is a potential surface for indirect prompt injection, it is a functional requirement of a literature review tool and is handled without evidence of malicious intent.

literature-review